[Bug target/103882] New: Register corruption in ASM only functions when optization is -O2/-Os/-O3

[Bug target/103882] New: Register corruption in ASM only functions when optization is -O2/-Os/-O3

[krystalgamer at protonmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103882

            Bug ID: 103882
           Summary: Register corruption in ASM only functions when
                    optization is -O2/-Os/-O3
           Product: gcc
           Version: 10.3.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: target
          Assignee: unassigned at gcc dot gnu.org
          Reporter: krystalgamer at protonmail dot com
  Target Milestone: ---
              Host: x86_64-linux-gnu
            Target: mips-linux-gnu
             Build: x86_64-linux-gnu

When a function is only composed of an `asm` statement if the optimizations are
at least -O2 it will make it assume none of the registers will be tainted.


Example code:

```
int is_first_char_a(const char *f){
        return f[0] == 'a';
}

void fail(){
        asm __volatile__ (
                "li $a0, 0x60606060\n"
                );
}

int example(char *c){
        fail();
        return is_first_char_a(c);
}

void __start(){}
```


Compiled with `-nostdlib -O1`, generates the following code:

```
00400180 <example>:
  400180:       27bdffe0        addiu   sp,sp,-32
  400184:       afbf001c        sw      ra,28(sp)
  400188:       afb00018        sw      s0,24(sp)
  40018c:       00808025        move    s0,a0
  400190:       0c10005d        jal     400174 <fail>
  400194:       00000000        nop
  400198:       82020000        lb      v0,0(s0)
  40019c:       38420061        xori    v0,v0,0x61
  4001a0:       2c420001        sltiu   v0,v0,1
  4001a4:       8fbf001c        lw      ra,28(sp)
  4001a8:       8fb00018        lw      s0,24(sp)
  4001ac:       03e00008        jr      ra
  4001b0:       27bd0020        addiu   sp,sp,32
```


Compiled with `-nostdlib -O2`, generates the following code:

```
00400180 <example>:
  400180:       3c046060        lui     a0,0x6060
  400184:       34846060        ori     a0,a0,0x6060
  400188:       80820000        lb      v0,0(a0)
  40018c:       38420061        xori    v0,v0,0x61
  400190:       03e00008        jr      ra
  400194:       2c420001        sltiu   v0,v0,1
```


As can be seen before -O1 levels of optimization the compiler saves $a0 in $s0
and then restores it. -O2 level and beyond causes the compiler to assume that
a0 is preserved.



>From what I can tell this might be because the optimizer doesn't take into
consideration ASM statements(which is good), but it makes wrong assumptions. A
possible solution would be to save the caller-saved registers whenever a
function with an ASM statement is called.

[Bug target/103882] Register corruption in ASM only functions when optization is -O2/-Os/-O3

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103882

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |inline-asm
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |INVALID

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
You either need to mark fail as noinline or you need to use extended inline-asm
to mark a0 as clobbered in the inline-asm. Or you need to have the inline-asm
save/restore a0.

[Bug target/103882] Register corruption in ASM only functions when optization is -O2/-Os/-O3

[krystalgamer at protonmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103882

Jose Silva <krystalgamer at protonmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |UNCONFIRMED
         Resolution|INVALID                     |---

--- Comment #2 from Jose Silva <krystalgamer at protonmail dot com> ---
Marking as noinline does not help.

See the generated code:

```
0040014c <example>:
  40014c:       27bdffe0        addiu   sp,sp,-32
  400150:       afbf001c        sw      ra,28(sp)
  400154:       0c100050        jal     400140 <fail>
  400158:       00000000        nop
  40015c:       80820000        lb      v0,0(a0)
  400160:       8fbf001c        lw      ra,28(sp)
  400164:       27bd0020        addiu   sp,sp,32
  400168:       38420061        xori    v0,v0,0x61
  40016c:       03e00008        jr      ra
  400170:       2c420001        sltiu   v0,v0,1

```

The marking as a clobbered does work, but it doesn't fix the underlying issue.
On my original code I had a `syscall`, which passes the code execution to the
kernel that I have no control over or know the full implementation.


The specific syscall was overwriting the $a0 register which I simplified in my
example.

GCC when -O2 is enabled is making too strong assumptions about the code. To
better illustrate the issue, let me give another example. If I call a function
via a function pointer regardless of the optimization level, GCC will save all
caller-saved registers in use. But when it encounters an ASM statement it
treats it like it doesn't exist. In my opinion, the same assumptions made when
calling from a function pointer should apply when calling a function with
inline-asm*.

* Manually indicating the clobbered registers could override this behaviour

[Bug target/103882] Register corruption in ASM only functions when optization is -O2/-Os/-O3

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103882

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |INVALID
             Status|UNCONFIRMED                 |RESOLVED

--- Comment #3 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Oh that is because there is some IPA Register allocation going on. Anyways this
is still not a bug. You need to mark a0 as a clobber in the inline-asm to let
GCC know that a0 is touched.

[Bug target/103882] Register corruption in ASM only functions when optization is -O2/-Os/-O3

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103882

--- Comment #4 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
noipa might help also. Though I can't remember if the IPA RA checks that (it
should).

[Bug target/103882] Register corruption in ASM only functions when optization is -O2/-Os/-O3

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103882

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
It does.

[Bug target/103882] Register corruption in ASM only functions when optization is -O2/-Os/-O3

[krystalgamer at protonmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103882

--- Comment #6 from Jose Silva <krystalgamer at protonmail dot com> ---
Yes, noipa does help.

(In reply to Andrew Pinski from comment #3)
> Oh that is because there is some IPA Register allocation going on. Anyways
> this is still not a bug. You need to mark a0 as a clobber in the inline-asm
> to let GCC know that a0 is touched.

As I said I simplified the example, the original code had a syscall which I
have no idea which registers will be clobbered.


Before upgrading compilers I was using GCC 3.2 which produces the following
code with `-nostdlib -Os`:

```
a0020060 <test>:
a0020060:       27bdfff0        addiu   sp,sp,-16
a0020064:       ffb00000        sd      s0,0(sp)
a0020068:       ffbf0008        sd      ra,8(sp)
a002006c:       0c008016        jal     a0020058 <fail>
a0020070:       0080802d        move    s0,a0
a0020074:       0200202d        move    a0,s0
a0020078:       dfbf0008        ld      ra,8(sp)
a002007c:       dfb00000        ld      s0,0(sp)
a0020080:       08008012        j       a0020048 <is_first_char_a>
a0020084:       27bd0010        addiu   sp,sp,16
```


I'm quite confused on why you say "Anyways this is still not a bug". IPA RA is
making assumptions on procedures where it does not have enough information to
do so, i.e functions with asm statements. It is disabled when a function
pointer is used, why shouldn't it be for when a function with ASM statement is
encountered?


The code inside the `fail()` function is valid and does not break the ABI, GCC
does not have enough information to perform IPA RA but does so(wrongly), to me
that's a bug.

[Bug target/103882] Register corruption in ASM only functions when optization is -O2/-Os/-O3

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103882

--- Comment #7 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
(In reply to Jose Silva from comment #6)
> Yes, noipa does help.
> 
> (In reply to Andrew Pinski from comment #3)
> > Oh that is because there is some IPA Register allocation going on. Anyways
> > this is still not a bug. You need to mark a0 as a clobber in the inline-asm
> > to let GCC know that a0 is touched.
> 
> As I said I simplified the example, the original code had a syscall which I
> have no idea which registers will be clobbered.

The compiler has no idea either (it has intentionally no idea what the inline
asm does, it is a black box to the compiler), so that is why you need to
specify it.  Look at C library sources, or kernel and find out what is and what
isn't clobbered and add the clobbers.

> I'm quite confused on why you say "Anyways this is still not a bug". IPA RA
> is making assumptions on procedures where it does not have enough
> information to do so, i.e functions with asm statements. It is disabled when
> a function pointer is used, why shouldn't it be for when a function with ASM
> statement is encountered?

Inline asms need to tell the compiler what registers they are setting, which
they are using and what they are clobbering, otherwise the shouldn't set, use
or clobber anything...  You can still e.g. save and restore the registers
yourself in the inline asm...

[Bug target/103882] Register corruption in ASM only functions when optization is -O2/-Os/-O3

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103882

--- Comment #8 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
BTW, all this is documented in the gcc documentation (on Basic Asm and Extended
Asm).

[Bug target/103882] Register corruption in ASM only functions when optization is -O2/-Os/-O3

[krystalgamer at protonmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103882

--- Comment #9 from Jose Silva <krystalgamer at protonmail dot com> ---
(In reply to Jakub Jelinek from comment #7)
> The compiler has no idea either (it has intentionally no idea what the
> inline asm does, it is a black box to the compiler), so that is why you need
> to specify it.  Look at C library sources, or kernel and find out what is
> and what isn't clobbered and add the clobbers.

It seems weird that GCC puts the sole responsibility on the programmer when
dealing with ASM. In my honest opinion, the compiler should be cautious when
interacting with hand-written ASM, the same way when interacting with function
pointers. 

It does allow for more optimization opportunities but it implies the programmer
knows a lot about the underlying architecture and system.



I'd like to implement a feature that automatically sets a function as noipa
when containing ASM statements, could you please point me in the codebase where
I could start?

[Bug target/103882] Register corruption in ASM only functions when optization is -O2/-Os/-O3

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103882

--- Comment #10 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
That is just a total misunderstanding why the compiler needs to know (be told)
the observable side-effects of the inline asm.  Interprocedural optimizations
are just one of the many reasons, much more important is that it needs to know
what the inline asm does for code generation within the function, it needs to
know in which registers or memory it can spill values live across the inline
asm etc.
Don't use inline asm if you are unable or not willing to tell the compiler how
it behaves.

[Bug target/103882] Register corruption in ASM only functions when optization is -O2/-Os/-O3

[krystalgamer at protonmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103882

Jose Silva <krystalgamer at protonmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|INVALID                     |WONTFIX

--- Comment #11 from Jose Silva <krystalgamer at protonmail dot com> ---
> much more important is that it needs to know what the inline asm does for code generation within the function, it needs to know in which registers or memory it can spill values live across the inline asm etc.
> if you are unable or not willing to tell the compiler how it behaves

Read the title of issue. This problem only manifests with O2/Os/O3, O0 and O1
don't exhibit it because IPA RA doesn't kick in. So no, the compiler doesn't
need to be told how it behaves if it takes precautions. The only reason to tell
a compiler something is to further optimize something, in any other
circumstance it should treat the piece of code as a black-box as you said.

What we're arguing here is about sensible compiler defaults. By default a
compiler should be cautious about asm statements and protect the surrounding
code by respecting the ABI. The programmer should be able to override this
behavior, not the other way around like GCC does.

There is absolutely no need to tell the compiler something he could've easily
accounted for.

> Don't use inline asm 

Wish I didn't need to, but there's no way of doing syscalls without it.



On the other hand, since you avoided answering my question regarding modifying
GCC I suppose you're not familiar with the codebase. Please refrain from
polluting this discussion with unnecessary noise if you don't wish to help.

[Bug target/103882] Register corruption in ASM only functions when optization is -O2/-Os/-O3

[schwab@linux-m68k.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103882

Andreas Schwab <schwab@linux-m68k.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|WONTFIX                     |INVALID

[Bug target/103882] Register corruption in ASM only functions when optization is -O2/-Os/-O3

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103882

--- Comment #12 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
That is solely because you didn't write anything else in the function, try to
put some code around the inline asm and you'll see how it will misbehave even
with noipa attribute.
Your code is invalid as documented in GCC documentation, the behavior is
undefined, it can do anything, break with different optimization levels,
different compiler versions or revisions, it can appear to work in some cases
the way you intended, but it is still broken.

[Bug target/103882] Register corruption in ASM only functions when optization is -O2/-Os/-O3

[krystalgamer at protonmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103882

Jose Silva <krystalgamer at protonmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|INVALID                     |WONTFIX

--- Comment #13 from Jose Silva <krystalgamer at protonmail dot com> ---
At this point I believe you're purposely misinterpreting the problem at hand
and justifying it with a bad implementation by waving the terrible GCC
documentation.


I didn't write anything around the ASM statement because I'm doing a syscall.
Even if I wasn't doing a syscall the code posted on the original post is valid
according to the ABI. The default behavior for a function composed of a single
ASM statement should be the same as if it was compiled separately with the
assembler. When writing the assembly code you don't need to tell the
assembler/compiler which registers were clobbered because there's an ABI - you
follow it? good. else enjoy UB.
Clobber information should be *only* for optimization purposes, else the
compiler should just stick to the ABI. I'm talking about ~sensible defaults~,
IPA shouldn't assume the best case scenario(no clobber) when no information is
provided to it, but the worst(spill every caller-saved register in use).



You've avoided answering my question twice and the only contribution to the
thread has been spamming me with insane amounts of copium regarding the
terrible GCC's IPA RA - bad defaults are not a feature. Unless you'd like to
help my modifications of GCC with something like giving me the contact of
someone that actually knows what they're talking about and has experience with
the codebase, refrain from posting.

[Bug target/103882] Register corruption in ASM only functions when optization is -O2/-Os/-O3

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103882

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|WONTFIX                     |INVALID

--- Comment #14 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
There is no special case for inline asm as the whole body of a function (except
that __attribute__((naked)) functions need to contain just that), it acts like
any other inline asm.  And like for any other inline asm, the user needs to
tell the compiler what side-effects it has.
You can define the whole function in top-level inline asm or in *.s/*.S file,
then the ABI applies for it.
Or just use the syscall function, see syscall(2) man page.
A hack that you want to propose (forcing noipa on functions that use inline
asm) certainly won't be accepted, that would penalize millions of correctly
written inline asm statements in real-world code.  Even if it is limited only
to functions that contain just a single inline asm statement and nothing else. 
Because even those are often desirable for inlining etc.
IPA RA is a very useful optimization, not something terrible.
And I've only spent last 23+ years working on GCC, so yes, I can't know the
codebase enough.

[Bug target/103882] Register corruption in ASM only functions when optization is -O2/-Os/-O3

[krystalgamer at protonmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103882

Jose Silva <krystalgamer at protonmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|INVALID                     |WORKSFORME

--- Comment #15 from Jose Silva <krystalgamer at protonmail dot com> ---
> IPA RA is a very useful optimization, not something terrible.
> that would penalize millions of correctly written inline asm statements in real-world code

It's a useful optimization but GCC offers a terrible implementation of it. 
As I elaborated before, if I have to always tell the compiler what my inline
asm is doing then it's just garbage.
If no clobber information is provided the compiler should just bail out of the
IPA RA for that given function and follow the ABI strictly. It could also emit
a warning telling the programmer that by not providing clobber information the
optimization is not as good.
With clobber information it should just trust the programmer.


If by "correctly written inline asm statements" you mean statements with
clobber information, then they wouldn't be penalized because they are providing
the necessary information. ~Sensible defaults~ is what I'm talking about.


Have you considered that users don't want to RE the kernel just to see what
registers are being clobbered? The ABI exists for that reason, if everyone
follows that there is no problem.


> (except that __attribute__((naked))
> Or just use the syscall function, see syscall(2) man page.
> And I've only spent last 23+ years working on GCC, so yes, I can't know the
> codebase enough.

naked is not supported as an attribute for MIPS targets. It was the first thing
I tried when trying to stop the compiler from optimizing the code.

The `syscall` function is useless for me because the platform I'm targeting
passes the number in $v1 and not $a0. And as I said in the original post, I'm
using `-nostdlib' so there's no access to the `syscall` function.

Stop making bad suggestions to try and justify a bad compiler optimization
implementation.


> A hack that you want to propose (forcing noipa on functions that use inline asm) certainly won't be accepted

I have no interest in upstreaming my changes. It was clear from the thread you
had no interest in it. I just requested some guidance on the toxic wasteland
that is the GCC codebase. If you don't want to help, don't bother responding.

[Bug target/103882] Register corruption in ASM only functions when optization is -O2/-Os/-O3

[schwab@linux-m68k.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103882

Andreas Schwab <schwab@linux-m68k.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|WORKSFORME                  |INVALID